fix(deploy): strip the tag from the dev-image ref before the skopeo probe #233

Merged

dominik.polakovics merged 1 commit from lab/20260725-1726 into main

2026-07-25 17:37:12 +02:00

dominik.polakovics commented

2026-07-25 17:29:19 +02:00

Owner

The deploy wait step (issue #230, ADR-0056) passed container.defaultImage's pinned ref to skopeo verbatim. The pin deliberately keeps the tag beside the digest for readability — buildpack-deps:stable-scm@sha256:07554a82… — but skopeo's docker:// transport rejects refs carrying both a tag and a digest, so every probe attempt failed on parse before reaching docker.io and the step spun until the 30-minute deadline killed the deploy.

The pin itself is correct: podman on the host accepts the name:tag@digest form and pulls by digest, and the tag-beside-digest convention comes from ADR-0053/0056. The fix lives in the probe alone — after the exactly-one extraction guard, the tag is stripped (sed -E 's/:[A-Za-z0-9._-]+@sha256:/@sha256:/', the same tag charset the extraction grep matches) and skopeo inspects name@digest. The digest alone determines what resolves, so the probe proves the same pull.

Verified locally: the extraction + strip pipeline against nix/module.nix yields docker://docker.io/library/buildpack-deps@sha256:07554a82…, and skopeo inspect --no-tags on that ref resolves anonymously (the tag+digest form reproduces the CI parse error).

Closes #232

🤖 Generated with Claude Code

The deploy wait step (issue #230, ADR-0056) passed `container.defaultImage`'s pinned ref to skopeo verbatim. The pin deliberately keeps the tag beside the digest for readability — `buildpack-deps:stable-scm@sha256:07554a82…` — but skopeo's `docker://` transport rejects refs carrying both a tag and a digest, so every probe attempt failed on parse before reaching docker.io and the step spun until the 30-minute deadline killed the deploy. The pin itself is correct: podman on the host accepts the `name:tag@digest` form and pulls by digest, and the tag-beside-digest convention comes from ADR-0053/0056. The fix lives in the probe alone — after the exactly-one extraction guard, the tag is stripped (`sed -E 's/:[A-Za-z0-9._-]+@sha256:/@sha256:/'`, the same tag charset the extraction grep matches) and skopeo inspects `name@digest`. The digest alone determines what resolves, so the probe proves the same pull. Verified locally: the extraction + strip pipeline against `nix/module.nix` yields `docker://docker.io/library/buildpack-deps@sha256:07554a82…`, and `skopeo inspect --no-tags` on that ref resolves anonymously (the tag+digest form reproduces the CI parse error). Closes #232 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dominik.polakovics added 1 commit

2026-07-25 17:29:19 +02:00

fix(deploy): strip the tag from the dev-image ref before the skopeo probe (issue #232 )

ci / native (pull_request) Successful in 7m50s

Details

20bb7f57fb

The wait step passed container.defaultImage's pinned ref to skopeo
verbatim, but the pin keeps the tag beside the digest for readability
(ADR-0056) and skopeo's docker:// transport rejects refs carrying both
— every probe attempt died on parse and the step spun until the
30-minute deadline. Podman on the host accepts the tag@digest form and
pulls by digest, so the pin stands; the probe now strips the tag and
inspects name@digest, which proves the same pull.

Closes #232

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

dominik.polakovics scheduled this pull request to auto merge when all checks succeed

2026-07-25 17:31:26 +02:00

dominik.polakovics merged commit 7f251ac3d9 into main

2026-07-25 17:37:12 +02:00

dominik.polakovics deleted branch lab/20260725-1726

2026-07-25 17:37:12 +02:00

dominik.polakovics referenced this pull request from a commit

2026-07-25 17:37:12 +02:00

Merge pull request 'fix(deploy): strip the tag from the dev-image ref before the skopeo probe' (#233) from lab/20260725-1726 into main

dominik.polakovics referenced this pull request

2026-07-25 19:51:48 +02:00

Containerized provider login: login panes and every provider-CLI invocation become podman run against the master store (ADR-0057) #234